The new DNS attacks, like other recent exploits, could allow a remote code
execution scenario, assuming that an attacker successfully compromises a vulnerable
system. In this case, Microsoft confirms, the attacker could run code in the
all-powerful Local System context -- the same security context in which the
Windows DNS service itself runs.

The attack targets the Windows DNS RPC interface, which appears to be susceptible
to a classic stack-based buffer overrun exploit. One workaround, Microsoft indicated,
is to disable support for DNS remote management over RPC in the Windows registry.
This doesn't actually patch the underlying vulnerability, the software giant
conceded, but does effectively insulate DNS from attack. This is also a recommended
security practice, experts said -- although it isn't always feasible, given
DNS topologies in many organizations.

"It depends on whether you need to be able to remotely manage the organization
in various physical proximities, so there's good reason for [DNS servers] to
be in disparate locations, and therefore a logical reason why you might need
to do [DNS management over RPC]," said Russ Cooper, a senior information
security analyst with Cybertrust Inc., and founder/editor of the NTBugtraq mailing
list. "That said, why not use Terminal Services instead? Then you can disable
the RPC and use [RDP], assuming you've enabled Terminal Services [on remote
DNS servers]."

Microsoft hasn't yet issued a patch; in its security advisory, Redmond said
it is investigating the attacks and could issue a patch in the future.

The new warning comes only days after security researchers disclosed the possibility
of several
new vulnerabilities in Microsoft's Word 2007 application, as well as a vulnerability
in its Windows .HLP file implementation. Redmond earlier this week published
four critical
security bulletins which collectively patch six vulnerabilities in its Windows
and Windows Content Management Server (CMS) offerings, as well.

Cooper, for his part, doesn't necessarily think there's been an uptick in attack
activity. He conceded, however, that targeted attacks seem to be a more frequent
occurrence.

"To be honest, I haven't thought of it in that way [as an uptick
in general attack activity]," Cooper said. "I guess if you group [the
new DNS attack] together with the alleged zero days in Microsoft Office, then,
yes, you could say there's an increase in targeted attack activity. We have
been concerned with targeted attacks for about a year now, but in general is
there more attack traffic? I would say no. It's still the same old attack traffic
coming across as attachments in e-mail -- just a lot more [targeted activity]."

About the Author

Stephen Swoyer is a contributing editor for Enterprise Systems. He can be reached at [email protected]